nixos/firejail: use local runCommand

Also:

- use `runtimeShell`; and
- remove unused `makeWrapper` input; and
- `exec()` to shed wrapping shell

nixos/modules/programs/firejail.nix

@@ -5,20 +5,20 @@ with lib;
 let
   cfg = config.programs.firejail;
 
-  wrappedBins = pkgs.stdenv.mkDerivation {
+  wrappedBins = pkgs.runCommand "firejail-wrapped-binaries"
-    name = "firejail-wrapped-binaries";
+    { preferLocalBuild = true;
-    nativeBuildInputs = with pkgs; [ makeWrapper ];
+      allowSubstitutes = false;
-    buildCommand = ''
+    }
+    ''
       mkdir -p $out/bin
       ${lib.concatStringsSep "\n" (lib.mapAttrsToList (command: binary: ''
-      cat <<_EOF >$out/bin/${command}
+        cat <<_EOF >$out/bin/${command}
-      #!${pkgs.stdenv.shell} -e
+        #! ${pkgs.runtimeShell} -e
-      /run/wrappers/bin/firejail ${binary} "\$@"
+        exec /run/wrappers/bin/firejail ${binary} "\$@"
-      _EOF
+        _EOF
-      chmod 0755 $out/bin/${command}
+        chmod 0755 $out/bin/${command}
       '') cfg.wrappedBinaries)}
     '';
-  };
 
 in {
   options.programs.firejail = {